Privacy policy

Who we are

codeblock Co. Ltd is a software development company based in Dar es Salaam, Tanzania. Our website is codeblock.co.tz and our contact email is hello@codeblock.co.tz.

For the personal data described in this policy, codeblock is usually the data controller. Where we process personal data inside a client's product or system, we usually act as the client's processor and the client's privacy notice will normally explain that processing.

Personal data we collect from website visitors

• Contact details you submit, such as name, work email, phone number, company, role, country, project details, preferred call times, and the consent confirmation attached to a form submission.
• Communication content, including messages, attachments, meeting notes, proposal requirements, feedback, call requests, and support requests.
• Technical data from your browser or device, such as IP address, user agent, language preference, referring page, pages visited, approximate time of visit, and cookie consent choices.
• Marketing and analytics data if you consent to optional cookies or if you interact with our campaigns, newsletters, social profiles, or events.
• Recruitment data if you apply for a role, including CV details, portfolio links, work history, education, references, interview notes, assessment results, and salary expectations.

Personal data we process for clients

When we design, build, integrate, host, maintain, or support software for a client, the product may contain personal data about the client's users, customers, staff, suppliers, patients, policyholders, merchants, agents, or other stakeholders. The categories depend on the project and are documented in the relevant contract or data processing agreement.

Examples include account records, identity details, contact data, payment references, transaction data, insurance policy data, support tickets, usage logs, device data, and audit records. We process that data only to deliver the contracted services and under the client's documented instructions.

How we collect personal data

• Directly from you when you complete a form, email us, call us, schedule a meeting, submit a job application, or provide details during a discovery process.
• From our clients when they invite us into a project, provide access to systems, share datasets, or request support.
• Automatically from your browser or device when you visit the website, subject to your cookie choices and applicable law.
• From third parties such as business partners, recruitment platforms, event organisers, public professional profiles, or client-approved vendors.

Why we use personal data

• Responding to project enquiries, feedback, call requests, preparing proposals, scheduling meetings, and managing sales conversations.
• Delivering software development, product design, integration, cloud, support, and managed service engagements.
• Managing contracts, invoices, procurement, supplier due diligence, and client relationship records.
• Recruiting, assessing, interviewing, and communicating with candidates.
• Improving our website, services, delivery process, security controls, and client experience.
• Protecting our systems, detecting abuse, preventing fraud, enforcing our terms, and maintaining operational logs.
• Complying with legal, tax, accounting, regulatory, reporting, and dispute-resolution obligations.
• Sending service updates, event invitations, insights, or marketing communications where permitted and where you can opt out.

Lawful basis for processing

We process personal data only where we have a lawful basis. Depending on the context, this may include consent, performance of a contract, steps before entering into a contract, compliance with a legal obligation, legitimate business interests, or another basis recognised by applicable law.

Where a website form asks for consent, we record the consent text, purpose, source page, language, and submission timestamp with the email notification so the stated purpose is clear.

For optional website cookies and similar technologies, we rely on consent where required. For client delivery work, the client is responsible for confirming the lawful basis for the product's processing unless codeblock acts as an independent controller for a defined activity.

Cookies and similar technologies

We use a c15t-powered consent banner to record your cookie choices. Necessary cookies and consent storage are used to keep the website operational and remember your privacy preferences. Optional cookies for functionality, measurement, or marketing are used only according to your choices and only when the relevant tool is configured.

You can change your choices through the privacy preferences trigger on the site or by clearing your browser storage. See our Cookie policy for more detail.

Sharing personal data

• With employees, contractors, and consultants who need access to perform their work for codeblock or a client engagement.
• With hosting, cloud, communication, analytics, security, project management, accounting, payment, and recruitment providers that support our operations, including Cloudflare for delivering website form submissions to codeblock.
• With clients, where your enquiry, support request, or project role relates to that client's product or contract.
• With professional advisers, auditors, insurers, regulators, courts, law enforcement, or public authorities where required or permitted by law.
• With a successor organisation if codeblock is involved in a merger, acquisition, restructuring, financing, or transfer of business assets, subject to appropriate safeguards.

International transfers

We work with clients and service providers across Tanzania, Africa, Europe, the Americas, and other regions. Personal data may therefore be accessed, hosted, or supported outside your country depending on the project, cloud region, vendor, and support model.

Where a transfer requires safeguards, we use contractual, organisational, and technical measures appropriate to the data, destination, and role of each party. For European clients, this may include GDPR data processing terms and standard contractual clauses where applicable.

Retention

• Website enquiries, consent stamps attached to form submissions, and sales communications are kept for as long as needed to respond, manage the opportunity, and maintain business records.
• Client project records are kept for the contract term and for a reasonable period afterwards for support, warranty, audit, legal, tax, and dispute purposes.
• Recruitment records are kept for the hiring process and a reasonable period afterwards, unless you agree that we may keep your details for future roles.
• Accounting, tax, corporate, and legal records are retained for the periods required by applicable law.
• Consent records are generally retained for up to 365 days unless you renew, change, or clear your preferences earlier.

Security

We use technical and organisational measures designed to protect personal data against unauthorised access, loss, misuse, alteration, and disclosure. These measures include access control, secure development practices, encryption where appropriate, environment separation, vulnerability management, and supplier review.

No online service can guarantee absolute security. If you believe your interaction with codeblock or a codeblock-built system has been compromised, contact us promptly at hello@codeblock.co.tz.

Your privacy rights

Depending on the law that applies to you, you may have rights to request access to your personal data, correction, deletion, restriction, portability, objection, withdrawal of consent, and information about how your data is used.

To exercise rights for data controlled by codeblock, email hello@codeblock.co.tz. We may need to verify your identity and clarify the scope of the request. If the data is controlled by one of our clients, we will direct the request to that client or assist the client as required by our contract.

Children and sensitive data

Our website and services are intended for business use and are not directed at children. Do not send us children's personal data unless it is necessary for an approved client project and covered by appropriate legal and contractual safeguards.

Do not send us sensitive personal data through the website contact form. If a project involves sensitive or regulated data, we will define the handling requirements in the project contract, security schedule, and data processing agreement.

Marketing choices

You can opt out of marketing communications by using the unsubscribe method in the message or by contacting us. Service messages, project communications, security notices, and contract-related messages are not marketing and may still be sent where relevant.

Complaints and regulators

We encourage you to contact us first so we can address your concern. If you are in Tanzania, you may also have the right to raise a complaint with the Personal Data Protection Commission. If you are in another jurisdiction, you may have rights before your local data protection authority.

Changes to this policy

We may update this policy when our services, vendors, legal obligations, or data practices change. The updated date at the top of the page shows when the policy was last revised.